Subject: [Asrg] Its all over for Challenge Response

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 28 Jan 2004 06:51:20 -0800

spammers have found a way to break C/R schemes that have a 'turing test'
component. 

You simply set up a free porn web site and get people to crack the turing
tests in return for seeing the porn.

http://yro.slashdot.org/article.pl?sid=04/01/28/1344207&mode=flat&tid=111&ti
d=126&tid=172&tid=95&threshold=1

	Phill

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 28 Jan 2004 10:54:21 -0500

[Please follow the posting guidelines, was "Re: [Asrg] Its all over for 
Challenge Response". Mod.]

Phil,

First of all this is ancient news, it was mentioned on the ASRG list 
back in November:

https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg07899.html

Additionally, we need to clarify this. The spammers do not break C/R per 
se, rather they overcome the reverse Turing test AKA CAPTCHA part of it. 
  The basic point of C/R is to make sure that the originating email 
address is valid and in order for spammers to do the scheme described 
here, they must have valid return addresses. Therefore, if any spammer 
wants to use this scheme, they become more traceable.

Yakov

P.S. There are also existing problems with using Turing tests, see the 
post linked to above for the W3C draft.

> d=126&tid=172&tid=95&threshold=1
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Some lies are easier to believe than the truth" (Dune)
-------

---

From: Philip Miller <[email-masked]>
Date: Wed, 28 Jan 2004 11:02:10 -0500

> d=126&tid=172&tid=95&threshold=1

We have seen this mentioned here before. This approach to C/R by spammers 
does have one beneficial side-effect: they must ensure that the challenge 
gets back to a useful address. Thus, they can no longer forge everything and 
expect mail to get through.

Perhaps we should start sending out fake challenges to spammers with 
problems that no one would reasonably be able to solve, like asking for 
proofs of various open problems in mathematics. :-)

Philip Miller

---

From: "Jon Kyme" <[email-masked]>
Date: Thu, 29 Jan 2004 15:15:29 +0000

> wants to use this scheme, they become more traceable.

Yep, *functioning* return addresses. Which adds some cost for the spammer -
but how small can this cost be? Of course, in the sense that "CAPTCHAs" are
proof-of-work, it highlights a generic issue with proof-of-work schemes in
that they assume that the work is *prohibitively* expensive. This is a way
of getting your "dirty deeds done dirt cheap", invalidating (?) the
assumption. However, I'm not sure that even with a popular porn site,
you're going to solve enough puzzles, fast enough, to support any sizable
spam run.

I'd be interested to know if anyone has actually seen an exploit.

--

---

From: Art Pollard <[email-masked]>
Date: Thu, 29 Jan 2004 10:30:39 -0700

>>tests in return for seeing the porn.

Yes. I agree  ... Sort of.

However, let's put it this way.  Even with all the "free" porn sites that 
could potentially be set up and even with the potentially large number of 
vistors that they could have, it would still be a signficant drop in the 
amount of spam.  I doubt that many would hang around a free porn site for 
long if they had to type/decypher a CR each time they switched pages.  It 
would simply be too irritating.  And besides, let's say a visitor visits 
20-50 pages, that would mean that for one spammer's spam to get through to 
1,000,000 addresses, they would need an equal number of page views or 
20,000-50,000 visitors -- a lot for any free porn site.  And of course, 
there are all the other spammers trying to do the same thing diluting the 
potential number of visitors.  This would still be a major bottleneck.

This sort of workaround seems to make sense for automating some things such 
as getting a Yahoo/Hotmail account or similar.  But it doesn't seem very 
practical to me for sending out millions of pieces of junk mail.

-Art
-- 
Art Pollard
http://www.lextek.com/
Suppliers of High Performance Text Retrieval Engines.

---

From: "Eric Dean" <[email-masked]>
Date: Fri, 30 Jan 2004 21:10:47 -0500

Does anyone have any idea how much it costs to host a porn site?  Does
anyone have any idea how little it costs to send spam (see prior
analysis $0.0000002/spam)?

Just because it's possible doesn't mean it's sensible

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Art Pollard
> Sent: Thursday, January 29, 2004 12:31 PM
> To: Philip Miller; [email-masked]
> Subject: Re: [Asrg] Its all over for Challenge Response
> 
> 
> >>spammers have found a way to break C/R schemes that have a 'turing 
> >>test' component. You simply set up a free porn web site and 
> get people 
> >>to crack the turing tests in return for seeing the porn.
>